lutaml-model 0.8.62 → 0.8.63

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93221695e02a0814183bb7935d242d416e7b5fc98fdae729ae7b7a548276fa1a
-  data.tar.gz: a8c6631206d1ed3dc635012999f11a2deb9f29409a441a4b85e8d47dd7f2fa9c
+  metadata.gz: e60ce4a1bedec13a3b778b0afea4c9be5c4779f721916bfafeb151e3bd8f8c1e
+  data.tar.gz: b6f519fabe6c9dc9c0c5edeb871d6afcc23d6439eff433b15b74b532b1a633d7
 SHA512:
-  metadata.gz: db7ee4ad6d440102cbf7c2c8452b20844c1ddb251a44f86d44f0655e14f359eb1e1fa17debc2f0857485c34b09c9199c6921c31a55b1910aa103ac0fd5e11ff8
-  data.tar.gz: c8a43921457c96865466b5cb0111ccd4e6aba04585bb6e398bc7ad6f808a2009f2bbffa48e8dc1348ba10937776c96c0707249ab54d0bc018d900c4799eb98e3
+  metadata.gz: 646c4cfdfb4dc395f5f339332eb214b0d4cba7bf31710884357e5d8519db8825e0a8e937824f268bac8642ea5d23a7fee75686988b9d3a54923f508e50aaa3c0
+  data.tar.gz: d738e9c618790d6575691acc7349991f1b4f28986947e75a3dc40a883978cbc3ce7f6ef28021b7c85f822037c6c63137ed22f1930fe6aba36dd0b266f84a451b

data/lib/lutaml/model/version.rb

@@ -2,6 +2,6 @@
 
 module Lutaml
   module Model
-    VERSION = "0.8.62"
+    VERSION = "0.8.63"
   end
 end

data/lib/lutaml/xml/adapter/xml_parser.rb

@@ -20,6 +20,7 @@ module Lutaml
           raw_xml = xml
           xml = normalize_xml_for_parse(xml)
           parsed = parse_with_moxml(xml, parse_encoding)
+          assert_no_truncated_recovered_parse!(parsed)
           root_element = parsed.root
 
           raise_empty_document_error if root_element.nil?
@@ -30,6 +31,25 @@ module Lutaml
           new(root, parse_encoding, **parse_document_options(raw_xml))
         end
 
+        # Recover-mode parsing must never masquerade input truncation as
+        # success.
+        #
+        # libxml2 (the Nokogiri backend) caps its input buffer at 10 MB;
+        # longer documents trip a fatal "Resource limit exceeded: Buffer
+        # size limit exceeded, try XML_PARSE_HUGE" error mid-input. In
+        # recover mode Nokogiri records that error on the document and
+        # returns the partial tree, so every node past the limit silently
+        # vanishes (lutaml-model#871). A resource-limit fatal means the
+        # engine stopped early with input left — refuse to deserialize the
+        # partial document instead of dropping trailing content without a
+        # trace.
+        #
+        # Other recover-mode fatals (e.g. an XML declaration after leading
+        # whitespace) do not drop content and keep the long-standing
+        # recover behavior; only the resource-limit family is truncating.
+        TRUNCATION_FATAL_MARKER =
+          /Resource limit exceeded|Buffer size limit exceeded/
+
         private
 
         def normalize_xml_for_parse(xml)
@@ -62,6 +82,23 @@ module Lutaml
           end
         end
 
+        def assert_no_truncated_recovered_parse!(parsed)
+          errors = parsed.parse_errors
+          return if errors.nil? || errors.empty?
+
+          fatal = errors.find do |message|
+            message.match?(TRUNCATION_FATAL_MARKER)
+          end
+          return if fatal.nil?
+
+          raise Lutaml::Model::InvalidFormatError.new(
+            :xml,
+            "the XML engine reported a fatal resource limit and recovered " \
+            "with a truncated document; refusing to deserialize " \
+            "partial input (#{fatal})",
+          )
+        end
+
         def parse_document_options(xml)
           {
             doctype: extract_doctype_from_xml(xml),

data/spec/lutaml/xml/adapter/recovered_fatal_parse_spec.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "nokogiri"
+require "lutaml/model"
+require "lutaml/xml"
+require "lutaml/xml/adapter/nokogiri_adapter"
+
+# Regression tests for lutaml-model#871.
+#
+# libxml2 (the Nokogiri backend) caps its input buffer at 10 MB. Parsing a
+# longer document in recover mode records a FATAL "Resource limit exceeded:
+# Buffer size limit exceeded, try XML_PARSE_HUGE" error on the document and
+# returns the partial tree, so every node past the cap silently vanishes.
+# XmlParser now refuses documents whose parse_errors carry a fatal error
+# instead of deserializing the truncated input.
+RSpec.describe "recovered fatal parse errors" do
+  let(:annex_class) do
+    Class.new(Lutaml::Model::Serializable) do
+      attribute :id, :string
+
+      xml do
+        element "annex"
+        map_attribute "id", to: :id
+      end
+    end
+  end
+
+  let(:root_class) do
+    annex = annex_class
+
+    Class.new(Lutaml::Model::Serializable) do
+      attribute :annexes, annex, collection: true
+
+      xml do
+        element "metanorma"
+        map_element "annex", to: :annexes
+      end
+    end
+  end
+
+  def build_document(chunk_count:, chunk_size:, with_tail: false)
+    filler = "A" * chunk_size
+    document = +"<metanorma>"
+    chunk_count.times do |index|
+      document << %(<annex id="annex#{index}" data="#{filler}"/>)
+    end
+    document << %(<annex id="annex-tail-marker"/>) if with_tail
+    document << "</metanorma>"
+    document
+  end
+
+  # Six 1.7 MB attribute values push the cumulative input past libxml2's
+  # 10 MB buffer cap mid-document, mirroring the issue's failing manifest.
+  def over_cap_document
+    build_document(chunk_count: 6, chunk_size: 1_700_000, with_tail: true)
+  end
+
+  it "hits the libxml2 buffer cap in recover mode past 10 MB" do
+    errors = Nokogiri::XML(over_cap_document) { |config| config.recover.nonet }.errors
+
+    expect(errors.map(&:message).join("\n")).to match(/\bFATAL:/)
+  end
+
+  it "raises instead of silently truncating on the nokogiri path" do
+    Lutaml::Model::Config.with_adapter(xml: :nokogiri) do
+      expect { root_class.from_xml(over_cap_document) }
+        .to raise_error(Lutaml::Model::InvalidFormatError, /resource limit.*truncated/m)
+    end
+  end
+
+  it "raises from the adapter layer directly" do
+    Lutaml::Model::Config.with_adapter(xml: :nokogiri) do
+      expect { Lutaml::Xml::Adapter::NokogiriAdapter.parse(over_cap_document) }
+        .to raise_error(Lutaml::Model::InvalidFormatError, /XML_PARSE_HUGE/)
+    end
+  end
+
+  it "keeps parsing documents whose fatals do not drop content" do
+    xml = "  <?xml version=\"1.0\"?>\n<metanorma><annex id=\"a\"/></metanorma>"
+
+    Lutaml::Model::Config.with_adapter(xml: :nokogiri) do
+      model = root_class.from_xml(xml)
+
+      expect(model.annexes.map(&:id)).to eq(["a"])
+    end
+  end
+
+  it "still parses smaller documents without any fatal-error handling" do
+    Lutaml::Model::Config.with_adapter(xml: :nokogiri) do
+      model = root_class.from_xml(
+        build_document(chunk_count: 2, chunk_size: 500_000, with_tail: true),
+      )
+
+      expect(model.annexes.map(&:id))
+        .to eq(["annex0", "annex1", "annex-tail-marker"])
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lutaml-model
 version: !ruby/object:Gem::Version
-  version: 0.8.62
+  version: 0.8.63
 platform: ruby
 authors:
 - Ribose Inc.
@@ -1902,6 +1902,7 @@ files:
 - spec/lutaml/xml/adapter/oga_adapter_spec.rb
 - spec/lutaml/xml/adapter/order_spec.rb
 - spec/lutaml/xml/adapter/ox_adapter_spec.rb
+- spec/lutaml/xml/adapter/recovered_fatal_parse_spec.rb
 - spec/lutaml/xml/adapter/rexml_adapter_spec.rb
 - spec/lutaml/xml/adapter/xml_namespace_spec.rb
 - spec/lutaml/xml/adapter_loader_spec.rb